This is an issue with CORS enabled browsers.
Proof Below :-
Added response header "Access-Control-Allow-Origin = * " to the preflight request and below is the custom extension rendered without any issue.
Support ticket to Qlik to enable CORS, or allow access to the request origin may solve the issue.
Without "Access-Control-Allow-Origin" response header, custom extension will not be shown.